How to Find Someone’s Email Address: 8 Proven Methods (2026)

Why Finding Email Addresses Is the Bottleneck in B2B Outreach

Cold email consistently delivers the highest ROI of any outbound channel, with returns of up to $42 for every $1 spent. But that ROI depends entirely on one thing: reaching the right person at the right address. A campaign aimed at the wrong email, or an address that bounces, does not just fail to convert. It actively damages your sender reputation, reducing deliverability for every subsequent email you send.

The problem is not that email addresses are hard to find in principle. Most professional addresses follow predictable patterns, are published somewhere online, or can be confirmed in seconds with a tool. The problem is that most teams either use only one method (which limits coverage) or skip verification entirely (which creates bounce risk).

This guide walks through 8 methods ranked by their real-world effectiveness in 2026. Each has a specific use case, a success rate range, and a clear answer to when it is and is not the right tool for the job.

Method 1: Use an Email Finder Tool

Best for: B2B outreach at any scale. The fastest path from a name and company to a verified, deliverable email address.

A professional email finder tool takes two inputs, typically a person's full name and their company domain, and returns their professional email address, confirmed as deliverable via SMTP check. What used to take 10 minutes of manual searching happens in under 2 seconds.

MailTester.Ninja's email finder is included in all paid plans and runs simultaneously with the 7-checkpoint verification process. You do not get a candidate address that might work. You get a confirmed, SMTP-verified address that has been checked for syntax, domain validity, MX records, mailbox existence, disposable inbox status, catch-all domain flags, and spam trap risk.

How to use MailTester.Ninja's email finder

Method 2: Check LinkedIn Contact Info

Best for: Finding emails for 1st and 2nd degree LinkedIn connections. Free and fast for individual lookups.

Many professionals list their email address directly on their LinkedIn profile, visible to connections. This is one of the most underused free methods because most people do not know where to look.

Method 3: Search the Company Website

Best for: Finding the email format used by a company, or directly finding the email of a specific person at a small or mid-size company.

Company websites regularly publish email addresses in ways most prospectors miss. The goal is not just to find one email but to identify the company's email format, which you can then apply to the target person.

Where to look

• Contact page, many companies publish at least one real address (not just a contact form)
• About or Team page, individual team member emails are often listed, especially at smaller companies
• Press or Media page, press contacts are almost always published as real email addresses
• Blog author bios, writers frequently include their email address
• Footer, some companies list a general contact email in the site footer
• Job listings, HR and recruiting contacts are sometimes published in job posts

Once you find one email address at a company (for example, sarah.jones@acme.com), you have identified the company's format (firstname.lastname@). Apply that format to your target person and verify the resulting address with MailTester.Ninja before sending.

Method 4: Guess the Email Pattern + Verify

Best for: When you know the company domain but cannot find the specific address via other methods. Works best at companies with 50 or more employees where patterns are standardised.

Research shows that firstname.lastname@company.com covers 46% of companies, making it the highest-probability first guess for any professional address. The key is not to send to guessed addresses, but to generate candidates and verify them before sending a single email.

The workflow: generate 3 to 5 candidate addresses using the most common patterns, then run all of them through MailTester.Ninja's verification. Valid addresses return a clear confirmation. Invalid ones return a hard reject. Never send to unverified guesses, a single hard bounce from a guessed address is more damaging to your sender reputation than five valid emails are positive.

Method 5: Google Search Operators

Best for: Finding emails that have been published publicly on any webpage, PDF, press release, or event page. Free. Works best for executives, authors, and public-facing professionals.

Google's advanced search operators allow you to search for email addresses associated with a specific person and domain, even when the address is buried deep in a document or an obscure webpage.

The most effective Google operators for finding emails

This method works best for people who are publicly active, speakers, authors, executives, or anyone with a digital footprint outside LinkedIn. For the average mid-level employee with limited public presence, it is less reliable and often returns no results.

Method 6: Social Media Bios and GitHub

Best for: Technical contacts (developers, data scientists, engineers) and public-facing professionals who list their email in their social bio.

Many professionals voluntarily publish their email address in publicly visible bios:

• Twitter/X bio, common for marketers, journalists, and thought leaders who want to be reachable
• GitHub profile, developers often list their professional email in their GitHub bio or README files. Each Git commit also contains an email address: search the person's commits to find it
• YouTube channel "About" tab, creators frequently include a business email address
• Instagram bio, public figures and creators sometimes list a contact email
• Personal website, if the person has a personal site or portfolio, a contact email is often there

Method 7: WHOIS Domain Lookup

Best for: Finding the owner of a small business or independent domain. Works less reliably in 2026 due to privacy protection services.

When someone registers a domain, their contact information, including email address, is recorded in the WHOIS database. Until 2018, this was publicly visible. GDPR and CCPA have since pushed most registrars to enable privacy protection by default, replacing the owner's real email with a proxy address.

The method still works for: US-based small businesses and sole traders who registered without privacy protection, older domain registrations that predate mandatory privacy defaults, and company domains registered via non-privacy-protected registrars.

To check: go to mxtoolbox.com/whois.aspx, enter the domain, and look for an email address in the registrant contact fields. If you see @privacy.registrar.com or similar, the owner has enabled privacy protection and this method will not return a real address.

Method 8: Ask Directly

Best for: Warm outreach, existing connections, referral situations. The highest success rate of any method, and the most compliant from a GDPR perspective.

The most overlooked method for finding email addresses is also the most reliable: ask. This works through several channels:

• LinkedIn connection request with a personalised note explaining why you want to connect, followed by a direct message asking for their preferred email
• Mutual contact introduction where a shared connection makes an email introduction
• Reply to their public content with a comment, then follow up with a connection request mentioning the content
• Conference or event follow-up where you met in person

The response rate for "ask directly" is dramatically higher than any cold outreach method because you have established some form of context or rapport before requesting the email. The person who gives you their email address has also implicitly consented to receiving your follow-up.

Which Method Should You Use?

Always Verify Before You Send

Regardless of the method used to find an email address, the address must be verified before it enters a sending campaign. This is non-negotiable, not because of best-practice guidelines, but because of hard ESP thresholds that trigger account warnings at 2% bounce rate and suspensions at 5%.

MailTester.Ninja's 7-checkpoint verification confirms that a found address:

• Is correctly formatted (syntax check)
• Belongs to a registered, active domain (domain check)
• Has configured mail exchange records (MX check)
• Exists as a specific mailbox on the receiving server (SMTP check)
• Is not a disposable inbox (disposable email detection)
• Is not on a catch-all domain that accepts all addresses regardless of existence (catch-all flag)
• Is not a known spam trap (spam trap screening)

For single addresses, use the free email verifier. For lists of hundreds or thousands, the Pro plan ($16.99/month) processes 100,000 addresses per day. For automated workflows, the MailTester.Ninja API verifies addresses in real time as they are found.

GDPR and Legal Considerations

Finding a professional email address is generally legal. Sending unsolicited commercial email to that address without a legitimate legal basis is not. The distinction matters because the two actions are often conflated.

What is generally legal in B2B outreach

• Finding publicly available professional contact information for legitimate business purposes
• Sending one relevant, personalised cold email to a business contact where you have a genuine "legitimate interest" basis under GDPR Article 6(1)(f)
• Using email addresses collected via opt-in forms, events, or other consent-based methods

What creates legal risk

• Sending to personal (non-professional) email addresses without explicit consent under GDPR
• Sending to consumers in the EU without prior consent under ePrivacy Directive
• Sending bulk commercial email to UK contacts without consent under PECR
• Using purchased email lists of unknown origin or provenance
• Continuing to email someone who has asked to stop

MailTester.Ninja stores no email address data after verification, making it fully GDPR compliant by design. Every verification check is performed in real time and discarded immediately. No data is retained, no list is stored.